Even worse! Any US site that has any users from California (which is ... any US site, because it's impossible to tell with any degree of certainty where a person is located) will have to age-verify all its users, because you can't tell who's under 18 (and thus needs to either be blocked or shunted into the babyproofed version of the site) without knowing who's under 18, and since there's no way to know who's under 18 without de-anonymizing users, that means every site in the US will have to identify all their users. (This law is basically a word-for-word copy of a UK law that was already passed; most of us small sites in the US who don't have a UK/EU business presence are planning on ignoring that one and letting the UK block us if they want, but we can't really do that with California.)
The law also doesn't only apply to sites that have "objectionable" content: it applies to every site, period. (Well, technically they tried to restrict it only to larger sites, but they did a really bad job of it: it also applies to smaller sites that buy, sell, or transmit user data, and you can't run a site without transmitting user data to someone for services you can't provide yourself. It applies to us because we use a third-party payment processor, for instance, and possibly -- did I mention it's vague and badly written -- also applies to anyone who uses caching or content delivery services, DDoS protection services, or possibly even anyone who uses cloud-based webhosting.)
The mandated content restrictions are, technically, only applicable to people located in California -- but, again, since sites can't reliably determine who's in California, the only way to guarantee that you don't violate the law is to restrict that content everywhere. Except AB 2273 explicitly contradicts other states' (and even federal) equally terrible content moderation and privacy laws! (Most of which are stayed at least until the Supreme Court rules on the two upcoming content moderation cases it's hearing this term, but that's a whole 'nother rabbit hole to go down that would take me a week to explain, heh.) So yeah, California saying "you can't show this kind of content to kids" would mean most sites would just restrict that type of content to people verified as being 18+ worldwide, because building "age-lock this, but only in California" is almost impossible. That's one of the issues raised in the motion for a stay, because something called the dormant commerce clause says that California can't interfere with a transaction between somebody in Maryland and somebody in Illinois -- which is what this law would do. (It's like the fifth unconstitutional thing about it!)
There are a lot of problems with the law, but the biggest is what's known as the "chilling effect": sites (and users!) will refrain from speech they would have otherwise engaged in out of fear of causing problems with this law. That's one of the many reasons we oppose it: we don't have the legal budget to keep a laywer on retainer to review every code change and every bit of "possibly harmful to children" content, so unless we wanted the state of California to be able to, at any point, impose massive fines that would put us out of business in three seconds flat, we would need to play it safe and restrict a huge amount of content that we don't want to restrict, demand a huge amount of personally-identifying information that we don't want to have (and you don't want to give us!) and slow down development even further because literally every line of code changed would prompt the need to write up a detailed, exhaustive analysis that the state could demand we turn over at any point.
...it's a really bad law, is what I'm saying. Heh.
no subject
The law also doesn't only apply to sites that have "objectionable" content: it applies to every site, period. (Well, technically they tried to restrict it only to larger sites, but they did a really bad job of it: it also applies to smaller sites that buy, sell, or transmit user data, and you can't run a site without transmitting user data to someone for services you can't provide yourself. It applies to us because we use a third-party payment processor, for instance, and possibly -- did I mention it's vague and badly written -- also applies to anyone who uses caching or content delivery services, DDoS protection services, or possibly even anyone who uses cloud-based webhosting.)
The mandated content restrictions are, technically, only applicable to people located in California -- but, again, since sites can't reliably determine who's in California, the only way to guarantee that you don't violate the law is to restrict that content everywhere. Except AB 2273 explicitly contradicts other states' (and even federal) equally terrible content moderation and privacy laws! (Most of which are stayed at least until the Supreme Court rules on the two upcoming content moderation cases it's hearing this term, but that's a whole 'nother rabbit hole to go down that would take me a week to explain, heh.) So yeah, California saying "you can't show this kind of content to kids" would mean most sites would just restrict that type of content to people verified as being 18+ worldwide, because building "age-lock this, but only in California" is almost impossible. That's one of the issues raised in the motion for a stay, because something called the dormant commerce clause says that California can't interfere with a transaction between somebody in Maryland and somebody in Illinois -- which is what this law would do. (It's like the fifth unconstitutional thing about it!)
There are a lot of problems with the law, but the biggest is what's known as the "chilling effect": sites (and users!) will refrain from speech they would have otherwise engaged in out of fear of causing problems with this law. That's one of the many reasons we oppose it: we don't have the legal budget to keep a laywer on retainer to review every code change and every bit of "possibly harmful to children" content, so unless we wanted the state of California to be able to, at any point, impose massive fines that would put us out of business in three seconds flat, we would need to play it safe and restrict a huge amount of content that we don't want to restrict, demand a huge amount of personally-identifying information that we don't want to have (and you don't want to give us!) and slow down development even further because literally every line of code changed would prompt the need to write up a detailed, exhaustive analysis that the state could demand we turn over at any point.
...it's a really bad law, is what I'm saying. Heh.